31.12.2012 Views

E-Discovery for Everybody: The EDna Challenge - Craig Ball

E-Discovery for Everybody: The EDna Challenge - Craig Ball

E-Discovery for Everybody: The EDna Challenge - Craig Ball

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

4. Expand files that hold messages and other files. Here, you should identify e-mail<br />

container files (like Outlook .PST files) and archives (e.g., .Zip files) that must be<br />

opened or decompressed to make their constituents amenable to search. For email,<br />

this can be done using an inexpensive utility like Aid4mail from Fookes<br />

Software or Trident Lite from Wave Software. Additionally, e-mail client<br />

applications, including Outlook, usually permit export of individual messages and<br />

attachments. Though dtSearch includes a command line utility to convert<br />

Outlook PST container files to individual messages (.MSG) files <strong>for</strong> indexing, it<br />

doesn't work well or easily compared to Aid4Mail. Finally, most indexing tools<br />

are capable of directly accessing text within compressed <strong>for</strong>mats. For example,<br />

DTSearch can extract text from Zip files and other archives.<br />

5. A feature common to premium e-discovery tools but hard to match with off-theshelf<br />

software is deduplication. You can use hash values to identify identical<br />

files, but the challenge is to keep track of all de-duplicated content and reliably<br />

apply tagging <strong>for</strong> privilege and responsiveness to all deduplicated iterations.<br />

Most off-the-shelf utilities simply eliminate duplicates and so aren't suited to ediscovery.<br />

This is where it's a good investment to secure help from an expert in Microsoft<br />

Excel or Access because those applications can be programmed to support<br />

deduplication tracking and tagging.<br />

When employing deduplication, keep in mind that files with matching hash values<br />

can have different filenames and dates. <strong>The</strong> hash identicality of two files speaks<br />

to the contents of the files, not the names assigned to the files by the operating<br />

system or to in<strong>for</strong>mation, like modified, accessed and created dates, stored<br />

outside the files.<br />

6. Above all, don't process and review ESI in a vacuum. Be certain that you<br />

understand the other side's expectations in terms of the scope of the ef<strong>for</strong>t,<br />

approach to search and--critically--the <strong>for</strong>ms of production they seek. You may<br />

not agree on much, but you may be pleasantly surprised to learn that some of the<br />

perils of a low budget e-discovery ef<strong>for</strong>t (e.g., altered metadata, limited search<br />

capabilities, native production <strong>for</strong>mats) don't concern the other side. Further, you<br />

may reach accord on limiting the scope of review in terms of time intervals,<br />

custodians and types of data under scrutiny. Why look at all the e-mail if the<br />

other side is content with your searching just communications between Don and<br />

Betty during the third week of January 2009?<br />

Finally, Edna may seek an answer to two common questions from those taking the doit-yourself<br />

route in e-discovery:<br />

What if I change metadata?<br />

Certain system metadata values--e.g., last access times and creation dates--are prone<br />

to alteration when processed using tools not designed <strong>for</strong> e-discovery. Such changes<br />

are rarely a problem if you adhere to three rules:

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!